infrastructure/machines/nixos/storage01/netbird.nix
Tom Hubrecht 88d9b8c3e3
Some checks failed
Check meta / check_dns (pull_request) Successful in 19s
Check meta / check_meta (pull_request) Successful in 20s
Check workflows / check_workflows (pull_request) Successful in 24s
Build all the nodes / ap01 (pull_request) Successful in 1m15s
Build all the nodes / bridge01 (pull_request) Successful in 1m53s
Build all the nodes / geo01 (pull_request) Successful in 1m55s
Build all the nodes / geo02 (pull_request) Successful in 1m53s
Build all the nodes / compute01 (pull_request) Successful in 2m33s
Build all the nodes / rescue01 (pull_request) Successful in 2m13s
Build all the nodes / storage01 (pull_request) Successful in 1m57s
Run pre-commit on all files / check (pull_request) Successful in 30s
Build all the nodes / web02 (pull_request) Successful in 1m47s
Build all the nodes / vault01 (pull_request) Successful in 2m21s
Build all the nodes / web03 (pull_request) Successful in 1m40s
Build all the nodes / web01 (pull_request) Successful in 2m54s
Check meta / check_dns (push) Successful in 20s
Check meta / check_meta (push) Successful in 19s
Check workflows / check_workflows (push) Successful in 25s
Build all the nodes / ap01 (push) Successful in 1m16s
Build all the nodes / bridge01 (push) Successful in 1m41s
Build all the nodes / geo02 (push) Successful in 1m44s
Build all the nodes / geo01 (push) Successful in 1m53s
Build all the nodes / compute01 (push) Successful in 2m20s
Build all the nodes / rescue01 (push) Successful in 1m49s
Build all the nodes / storage01 (push) Successful in 1m46s
Build all the nodes / vault01 (push) Successful in 1m45s
Run pre-commit on all files / check (push) Successful in 30s
Build all the nodes / web02 (push) Has been cancelled
Build all the nodes / web01 (push) Has been cancelled
Build all the nodes / web03 (push) Has been cancelled
chore: Add license and copyright information
Signed-off-by: Tom Hubrecht <tom.hubrecht@dgnum.eu>
Acked-by: Ryan Lahfa <ryan.lahfa@dgnum.eu>
Acked-by: Maurice Debray <maurice.debray@dgnum.eu>
Acked-by: Lubin Bailly <lubin.bailly@dgnum.eu>
Acked-by: Jean-Marc Gailis <jean-marc.gailis@dgnum.eu> as the legal authority, at the time of writing, in DGNum.
Acked-by: Elias Coppens <elias.coppens@dgnum.eu> as a member, at the time of writing, of the DGNum executive counsel.
2024-12-13 12:41:38 +01:00

86 lines
2 KiB
Nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
{
config,
lib,
nixpkgs,
...
}:
let
domain = "netbird.dgnum.eu";
s = name: config.age.secrets.${name}.path;
in
{
services = {
netbird.server = {
enable = true;
package = nixpkgs.nixos.unstable.netbird;
inherit domain;
enableNginx = true;
coturn.enable = lib.mkForce false;
relay = {
environmentFile = s "netbird-relay_environment_file";
metricsPort = 9094;
};
dashboard = {
settings = {
AUTH_AUTHORITY = "https://sso.dgnum.eu/oauth2/openid/dgn_netbird";
AUTH_AUDIENCE = "dgn_netbird";
AUTH_CLIENT_ID = "dgn_netbird";
};
};
management = {
oidcConfigEndpoint = "https://sso.dgnum.eu/oauth2/openid/dgn_netbird/.well-known/openid-configuration";
dnsDomain = "dgnum";
metricsPort = 9092;
settings = {
DataStoreEncryptionKey._secret = s "netbird-data_store_encryption_key_file";
PKCEAuthorizationFlow.ProviderConfig = {
Audience = "dgn_netbird";
ClientID = "dgn_netbird";
AuthorizationEndpoint = "https://sso.dgnum.eu/ui/oauth2";
TokenEndpoint = "https://sso.dgnum.eu/oauth2/token";
};
IdpManagerConfig.ClientConfig.ClientID = "dgn_netbird";
DeviceAuthorizationFlow = {
Provider = "none";
ProviderConfig = {
Audience = "dgn_netbird";
ClientID = "dgn_netbird";
};
};
Relay = {
Addresses = [ "rels://${domain}:443" ];
CredentialsTTL = "24h";
Secret._secret = s "netbird-relay_secret_file";
};
};
};
};
nginx.virtualHosts.${domain} = {
enableACME = true;
forceSSL = true;
};
};
dgn-backups.jobs.netbird.settings.paths = [ "/var/lib/netbird-mgmt" ];
}